ShuriZma
/
xqemu
mirror of https://github.com/xqemu/xqemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ivshmem: Tighten check of property "size" 

If size_t is narrower than 64 bits, passing uint64_t ivshmem_size to
mmap() truncates.  Reject such sizes.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <1458066895-20632-31-git-send-email-armbru@redhat.com>
This commit is contained in:
Markus Armbruster 2016-03-15 19:34:45 +01:00
parent ee276391a3
commit 08183c20b8
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
hw/misc/ivshmem.c
View File

@ -87,7 +87,7 @@ typedef struct IVShmemState {
*/ */
MemoryRegion bar; MemoryRegion bar;
MemoryRegion ivshmem; MemoryRegion ivshmem;
uint64_t ivshmem_size; /* size of shared memory region */ size_t ivshmem_size; /* size of shared memory region */
uint32_t ivshmem_64bit; uint32_t ivshmem_64bit;
Peer *peers; Peer *peers;
@ -361,7 +361,7 @@ static int check_shm_size(IVShmemState *s, int fd, Error **errp)
if (s->ivshmem_size > buf.st_size) { if (s->ivshmem_size > buf.st_size) {
error_setg(errp, "Requested memory size greater" error_setg(errp, "Requested memory size greater"
" than shared object size (%" PRIu64 " > %" PRIu64")", " than shared object size (%zu > %" PRIu64")",
s->ivshmem_size, (uint64_t)buf.st_size); s->ivshmem_size, (uint64_t)buf.st_size);
return -1; return -1;
} else { } else {
@ -865,7 +865,8 @@ static void pci_ivshmem_realize(PCIDevice *dev, Error **errp)
} else { } else {
char *end; char *end;
int64_t size = qemu_strtosz(s->sizearg, &end); int64_t size = qemu_strtosz(s->sizearg, &end);
if (size < 0 || *end != '\0' || !is_power_of_2(size)) { if (size < 0 || (size_t)size != size || *end != '\0'
|| !is_power_of_2(size)) {
error_setg(errp, "Invalid size %s", s->sizearg); error_setg(errp, "Invalid size %s", s->sizearg);
return; return;
} }